deps: update Pulumi runtime and regenerate SDKs

.github/workflows/release.yml

@@ -69,7 +69,7 @@ jobs:
     - name: Install Pulumi CLI
       uses: pulumi/actions@96c7761824268174e0d2a4e8c7d75671eebd24a7 # v7.1.0
       with:
-        pulumi-version: 3.272.0
+        pulumi-version: 3.274.1
     - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: '24.22.3'

docs/dependency-versions.md

@@ -1,62 +1,49 @@
-# Dependency refresh (2026-09-14)
+# Dependency baseline
 
-The provider, Terraform shim, Go SDK, examples, and Node.js SDK were updated
-together. Go module versions were checked with `go list -m -u -json all` against
-each module's declared requirements after `go get -u` and `go mod tidy`.
-Example test dependencies were included with `go get -tags=all -t -u ./...`.
-The Node.js lockfile was refreshed with `yarn upgrade`; `yarn outdated` reports
-no newer direct dependencies within the selected major versions.
+The provider, Terraform shim, Go SDK, examples, and Node.js SDK are maintained
+together. Dependabot covers all four Go modules, the Node.js SDK, and GitHub
+Actions. Updates must include regenerated schema, mux metadata, and SDKs whenever
+generation changes.
 
 | Component | Version |
 | --- | --- |
-| Terraform Rootly provider | 5.21.1 |
-| Pulumi Terraform bridge | 3.139.0 |
-| Pulumi CLI, Go and Python dependency baselines | 3.262.0 |
+| Terraform Rootly provider and shim | 5.25.2 |
+| Pulumi Terraform bridge | 3.143.0 |
+| Pulumi CLI and Go packages | 3.274.1 |
 | Node.js SDK Pulumi dependency minimum | 3.274.1 |
+| Python SDK Pulumi dependency minimum | 3.262.0 |
 | Go JOSE dependency minimum | 4.1.6 |
 | .NET Pulumi dependency baseline | 3.113.2 |
 | Go | 1.27.4 |
 | Node.js | 24.22.3 |
 | TypeScript / Node.js types | 7.0.2 / 24.13.4 |
 | Python / .NET SDK | 3.14.7 / 10.0.400 |
 | Yarn Classic | 1.22.22 |
-| golangci-lint / govulncheck | 2.13.2 / 1.8.0 |
+| golangci-lint / govulncheck | 2.14.0 / 1.8.0 |
 | pulumictl / GoReleaser | 0.0.50 / 2.18.1 |
 | Random plugin used by the build | 4.21.1 |
 
-GitHub Actions are pinned to the current release commits. Local development and
-the development container share `mise.toml`; CI and release templates use the
-same Go and Node.js generation. The obsolete, unused `@types/mime` dependency
-and `imdario/mergo` override were removed.
-
 ## Compatibility constraints
 
-- The bridge requires Pulumi's Terraform SDK fork at
-  `v2.0.0-20260318212141-5525259d096b`. Keep its `replace` directive aligned with
-  the bridge rather than replacing it with HashiCorp's SDK.
-- `github.com/pulumi-labs/pulumi-hcl` stays at 0.12.0. Later releases declare
-  `github.com/pulumi/pulumi-hcl`, while bridge 3.139.0 still imports the old path.
-  Go rejects those versions with a module-path mismatch.
-- The examples use mpb 8.15.2. Both 8.16.0 and 8.16.1 change `ProxyReader` to
-  return two values, breaking Pulumi 3.262.0's integration-test helper build.
-- Node.js and its type definitions stay on the requested Node 24 LTS line.
-  The published npm package declares `engines.node: >=24`.
-- Yarn remains on the latest Classic release, 1.22.22, for the provider's build
-  and SDK linking workflow. Transitive npm dependencies follow their upstream
-  packages' supported version ranges.
-
-The HCL and mpb constraints are the only newer versions reported for declared
-Go requirements; the SDK and shim have none. Revisit these constraints when
-upgrading the Pulumi bridge and packages.
-
-## Validation
-
-Provider and SDK generation/builds, provider race tests, lint, Go SDK and shim
-compilation, and example helper compilation pass. The example helpers do not
-contain live acceptance tests. `govulncheck` reports no vulnerable imported
-packages or reachable vulnerabilities across all four Go modules. An unused
-`x/crypto/openpgp` module-only advisory has no patched release. Yarn audit reports
-zero vulnerabilities across 242 dependencies, and a frozen-lockfile build passes.
-
-The development container was not built locally because the Docker daemon was
-unavailable. Its configured tool versions were installed and exercised locally.
+- Keep the Terraform SDK replacement aligned with Pulumi's bridge:
+  `github.com/pulumi/terraform-plugin-sdk/v2` at
+  `v2.0.0-20260318212141-5525259d096b`.
+- The examples retain mpb 8.15.2. Check Pulumi integration helper compatibility
+  before updating it; earlier updates changed the `ProxyReader` signature.
+- Node.js and its type definitions stay on the Node 24 LTS line. The published
+  npm package declares `engines.node: >=24`.
+- Yarn remains on Classic 1.22.22 for the build and SDK linking workflow.
+  Transitive npm dependencies follow upstream-supported version ranges.
+
+## Security validation
+
+Run schema/SDK generation, provider tests and lint, Go SDK and shim compilation,
+example helper compilation with `-tags=all`, and a frozen Node.js SDK build.
+Run govulncheck 1.8.0 built with the repository's Go toolchain in each Go module,
+and audit the Node.js dependency lockfile.
+
+Credential regressions exercise provider Check inputs (including nested headers
+and passwords), heartbeat Read outputs, schema secret flags, and unchanged public
+sibling values. Existing tests cover mux dispatch and schedule rotation state
+compatibility. Secret tagging applies to new provider results; it does not
+retroactively rewrite historical checkpoints.

examples/go.mod

@@ -2,30 +2,10 @@ module github.com/rootlyhq/pulumi-rootly/examples
 
 go 1.27.4
 
-require github.com/pulumi/pulumi/pkg/v3 v3.272.0
+require github.com/pulumi/pulumi/pkg/v3 v3.274.1
 
 require (
-	cel.dev/expr v0.25.3 // indirect
-	cloud.google.com/go v0.123.0 // indirect
-	cloud.google.com/go/auth v0.23.2 // indirect
-	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
-	cloud.google.com/go/compute/metadata v0.9.0 // indirect
-	cloud.google.com/go/iam v1.13.0 // indirect
-	cloud.google.com/go/kms v1.33.0 // indirect
-	cloud.google.com/go/logging v1.19.1 // indirect
-	cloud.google.com/go/longrunning v1.2.0 // indirect
-	cloud.google.com/go/monitoring v1.30.0 // indirect
-	cloud.google.com/go/storage v1.67.1 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.1 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect
-	github.com/AzureAD/microsoft-authentication-library-for-go v1.9.0 // indirect
 	github.com/BurntSushi/toml v1.6.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.38.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.62.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.62.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/ProtonMail/go-crypto v1.5.2 // indirect
 	github.com/VividCortex/ewma v1.2.0 // indirect
@@ -41,12 +21,10 @@ require (
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.3 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.3 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.87.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.11.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.20.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/kms v1.60.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.113.1 // indirect
 	github.com/aws/aws-sdk-go-v2/service/signin v1.10.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.38.0 // indirect
@@ -57,7 +35,6 @@ require (
 	github.com/bazelbuild/buildtools v0.0.0-20260904073137-eaa4d125b423 // indirect
 	github.com/blang/semver v3.5.1+incompatible // indirect
 	github.com/bmatcuk/doublestar/v4 v4.10.0 // indirect
-	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/charmbracelet/bubbles v1.0.0 // indirect
@@ -70,17 +47,13 @@ require (
 	github.com/clipperhouse/displaywidth v0.11.0 // indirect
 	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
 	github.com/cloudflare/circl v1.6.5 // indirect
-	github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect
 	github.com/danieljoos/wincred v1.2.3 // indirect
 	github.com/deckarep/golang-set/v2 v2.9.0 // indirect
 	github.com/djherbis/times v1.6.0 // indirect
 	github.com/ebitengine/purego v0.11.0 // indirect
 	github.com/edsrzf/mmap-go v1.2.0 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
-	github.com/envoyproxy/go-control-plane/envoy v1.39.0 // indirect
-	github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
-	github.com/felixge/httpsnoop v1.1.0 // indirect
 	github.com/git-pkgs/manifests v0.12.1 // indirect
 	github.com/git-pkgs/pom v0.1.7 // indirect
 	github.com/git-pkgs/purl v0.1.20 // indirect
@@ -95,44 +68,26 @@ require (
 	github.com/godbus/dbus/v5 v5.2.2 // indirect
 	github.com/gofrs/uuid v4.4.0+incompatible // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
 	github.com/golang/glog v1.2.5 // indirect
-	github.com/google/go-querystring v1.2.0 // indirect
 	github.com/google/go-tpm v0.9.8 // indirect
-	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/google/wire v0.7.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.22 // indirect
-	github.com/googleapis/gax-go/v2 v2.24.1 // indirect
-	github.com/gorilla/mux v1.8.1 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.32.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.33.0 // indirect
 	github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
-	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
-	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
-	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect
-	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
-	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
 	github.com/hashicorp/go-version v1.9.0 // indirect
-	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
 	github.com/hashicorp/hcl/v2 v2.24.0 // indirect
-	github.com/hashicorp/vault/api v1.23.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kevinburke/ssh_config v1.6.0 // indirect
 	github.com/klauspost/compress v1.20.2 // indirect
-	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.4.1 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
 	github.com/mattn/go-runewidth v0.0.31 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
-	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
-	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
@@ -147,17 +102,14 @@ require (
 	github.com/pgavlin/fx/v2 v2.0.12 // indirect
 	github.com/pgavlin/goldmark v1.1.33-0.20200616210433-b5eb04559386 // indirect
 	github.com/pjbgf/sha1cd v0.7.0 // indirect
-	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/term v1.1.0 // indirect
-	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect
 	github.com/pulumi/inflector v0.2.1 // indirect
-	github.com/pulumi/pulumi-cloud-sdk/go v1.20260918.0 // indirect
-	github.com/pulumi/pulumi/sdk/v3 v3.272.0 // indirect
+	github.com/pulumi/pulumi-cloud-sdk/go v1.20261104.0 // indirect
+	github.com/pulumi/pulumi/sdk/v3 v3.274.1 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rogpeppe/go-internal v1.16.0 // indirect
-	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect
 	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 // indirect
 	github.com/segmentio/asm v1.2.1 // indirect
@@ -166,7 +118,6 @@ require (
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cobra v1.10.2 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
-	github.com/spiffe/go-spiffe/v2 v2.8.1 // indirect
 	github.com/stretchr/testify v1.12.1 // indirect
 	github.com/texttheater/golang-levenshtein v1.0.1 // indirect
 	github.com/uber/jaeger-client-go v2.30.0+incompatible // indirect
@@ -182,12 +133,9 @@ require (
 	github.com/zclconf/go-cty v1.19.0 // indirect
 	go.mongodb.org/mongo-driver v1.17.10 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/collector/featuregate v1.69.0 // indirect
-	go.opentelemetry.io/collector/pdata v1.69.0 // indirect
+	go.opentelemetry.io/collector/featuregate v1.70.0 // indirect
+	go.opentelemetry.io/collector/pdata v1.70.0 // indirect
 	go.opentelemetry.io/contrib/bridges/otelslog v0.21.0 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.46.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.72.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.72.0 // indirect
 	go.opentelemetry.io/otel v1.47.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.23.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0 // indirect
@@ -196,30 +144,22 @@ require (
 	go.opentelemetry.io/otel/metric v1.47.0 // indirect
 	go.opentelemetry.io/otel/sdk v1.47.0 // indirect
 	go.opentelemetry.io/otel/sdk/log v1.47.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.47.0 // indirect
 	go.opentelemetry.io/otel/trace v1.47.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.11.1 // indirect
 	go.uber.org/atomic v1.12.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	gocloud.dev v0.46.1-0.20260810195832-b5401c07b5f1 // indirect
-	gocloud.dev/secrets/hashivault v0.46.0 // indirect
 	golang.org/x/crypto v0.58.0 // indirect
 	golang.org/x/mod v0.42.0 // indirect
-	golang.org/x/net v0.61.0 // indirect
-	golang.org/x/oauth2 v0.37.0 // indirect
+	golang.org/x/net v0.62.0 // indirect
 	golang.org/x/sync v0.24.0 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 	golang.org/x/term v0.47.0 // indirect
 	golang.org/x/text v0.43.0 // indirect
-	golang.org/x/time v0.16.0 // indirect
 	golang.org/x/tools v0.52.0 // indirect
-	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
-	google.golang.org/api v0.298.0 // indirect
-	google.golang.org/genproto v0.0.0-20260911204522-f61a6ca850bd // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20261019180522-ce908d29299b // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20261019180522-ce908d29299b // indirect
-	google.golang.org/grpc v1.84.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20261026165753-2ffab32bce7e // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20261026165753-2ffab32bce7e // indirect
+	google.golang.org/grpc v1.85.0 // indirect
 	google.golang.org/protobuf v1.36.12 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	lukechampine.com/frand v1.5.1 // indirect